4 ms·yea, I'd second the xss, since using rails one sanitize call should be enough.by jfaucett 12y agoyea, I'd second the xss, since using rails one sanitize call should be enough.ch0wn 12y agoAnd setting user cookies to HTTP only.